Authentication

Registration

Registration endpoint: http://localhost/api/v1/register/

Request

Content-Type: application/json

{
  "username": "Markie1",   
  "password": "polakie1",
  "email": "[email protected]",
  "birthday": "2000-10-20"
}

Successful Response (201 CREATED)

{
    "client_id": "3642365ea517dd4b38b4",
    "client_secret": "52983e4b941c843d92b3a81648f851a8a0eae700"
}

Non successful Response (400, 500)

Currently gives either a string when the data is not correct or a json object when a 500 error is thrown.

Login / getting the access token

Login endpoint: http://localhost/oauth2/access_token/

Request

Currently this is implemented using the default OAuth2 way that is supported by the library we use. This takes the following parameters

grant_type: password
username: Markie1
password: polakie1
client_id: 6518f8826017d3a7aa7a
client_secret: 88d961c7d1560713979f59be5551381c01761ca2
scope: read

More information can be found here How to request an access token for the first time?

Response

Successful Response (201 CREATED)

{
    "access_token": "5f254e76a97f9ef108d81b7f124de98556ed5f27",
    "scope": "read",
    "expires_in": 31535999,
    "refresh_token": "3046f0c27ca2a05ae2bbd9cbcb82a553783dcf07"
}

Non successful Response (400)

{
    "error": "invalid_client"
}

Refreshing expired access_tokens

Expired tokens can be refreshed by sending the client id and secret and the refresh token

Request

client_id: 6518f8826017d3a7aa7a
client_secret: 88d961c7d1560713979f59be5551381c01761ca2
grant_type: refresh_token
refresh_token: 725d8233616dbd4428861bf1d7bd412d873e537d

Response

Successful Response (200 OK)

{
    "access_token": "0acf82d1b50baf3eb9e8f5e05dfcd020ca85d290",
    "scope": "read",
    "expires_in": 31535999,
    "refresh_token": "571ba5dafe3ab2c8c7c654668f5176e84d9c6866"
}

Requesting things when authenticated

To do any follow up requests when authenticated add a basic authorization http header with the access_token prefixed by "OAuth "

Authorization: OAuth 0072200a6f494f4b9ded16daf9692337606895bd

TODO

• Add a section on how to get the client id and secret when they are lost?....